Docker Buildx bake skips consent step, allowing code execution
A container build tool can let malicious files hack your PC.
Summary
In Docker Buildx's bake command, the consent check for filesystem access is skipped under --progress=rawjson. A malicious bake definition can run code as the current user; versions from 0.21.0 onward are affected.
Affected when
- Running bake with --progress=rawjson
- Untrusted bake definition files
What to do
Update Buildx to 0.37.2 or later. Until then, do not run bake with --progress=rawjson on untrusted definitions.
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab)
- Write-up: zerodayinitiative.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen